Sample details: 37d8c91621a8d3e7751a80894a290937 --

Hashes
MD5: 37d8c91621a8d3e7751a80894a290937
SHA1: 62b59795908fde49b9aa9abcf345d79fb9235b2e
SHA256: f391b4b9c1c64d04101d258c57640aebb3bc7f69f999ca97d1a11c651baeb674
SSDEEP: 6144:weRBIiFyWNwt/806xUEbEIsXeKlR3+WthO3zy/HHlfn5BE1UODw5OgaL:wuF6qUEOdPzthOOFRy1/+Ogo
Details
File Type: PE32
Yara Hits
YRP/Microsoft_Visual_Basic_v50v60 | YRP/Microsoft_Visual_Basic_v50 | YRP/Microsoft_Visual_Basic_v50_v60 | YRP/Microsoft_Visual_Basic_v50_additional | YRP/Microsoft_Visual_Basic_v50v60_additional | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/HasRichSignature | YRP/maldoc_find_kernel32_base_method_1 | YRP/domain | YRP/contentis_base64 | YRP/SEH__vba |
Source
http://dhm-mhn.com/sunday/crypted2.exe
http://dhm-mhn.com/sunday/crypted2.exe
Strings
		!This program cannot be run in DOS mode.
`.data
MSVBVM60.DLL
Gonorernes4
borasqueborate
Orthographic4
IIIII33333333+MG
qIII33833M8
_"?OSJ'
};IIWd
*nnu@I5K
#\rz,`%
j$[cbC
33~s!/jR	
M333~GL4
033333
33333333EPTT5
Orthographic4
Command1
Command1
VB5!6&*
Aktuelt2
Gonorernes4
Gonorernes4
borasqueborate
Lsgrelse6
Homotopic
Cricotomy
Befugter8
Svejfningerne
mediary
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
Command1
VBA6.DLL
__vbaFreeStr
__vbaFreeVarList
__vbaEnd
__vbaFreeObj
__vbaHresultCheckObj
__vbaObjSet
__vbaFreeVar
__vbaVarDup
__vbaStrMove
Cricotomy
Befugter8
Thistlewool0
Thistlewool0
Svejfningerne
husfrelse
husfrelse
Homotopic
Programdirektren5
Programdirektren5
Lsgrelse6
Unfranked
7n9^@j?.^4e-*
CGXvT/ajS
[x?L,k
kS{M2v
jK1	}9
g~Iq|Mm
J[bTZv
dT4Txk
[83{[f
qGOS#s
:dDgJ=
k-8oZd
b0-ztNT3
om V<r
wD$)U*~j
XQa\N*H
>/")%V
g8,Ov>|
m~7Ah/
:8J"C<
y&mlmiw
*+?aT#&
3,ORQ&
W5Q==G
s		z~nS
Y:Vya\>
"H/@(\
a4k	\0
g[qz*;O
>(vo4U
Ly]KM4
TB(2Y,
^&.Q<)
fc@murU
A>Q75e
m0lFem
~Az5\M
GdP9Fc
%?cI.A
yHOuu\
V(zUy6
QnLh'pP
7\dW}2
gM(d0y>^w
]a"CV=
BS24>?
KAVf3U
y%-z5\
t<ZjOS
\b@{:Q
jAWQ@xs
bKU{9t
^9cvAL
QscfYV
>7"wem
{&pB2I
U]>(A$G
.$S}	7
/1JY(+
`Br;?gI
_8<R8QG
_/st[+c+_
q,#g=&-
nu9!~F
R/u5{>
C5a'=Vz
Q-Vxz9A
3y55m[
of{7$5
PGwVT\;
r7jQ9b
sN`gK*
M:aa TA
>kf8:rD 
NJ~!h9#
(znT?oA
za3:(KQ	
fH8&n*j
N[8)&8.^Y
"/\TWm
1cr,p[]fC
jR=?t&
0]XnrSa
~J44aLB
CAqz6a
zJzOF9.
A.%a4_
e>Rv&:
ol{S}H
):t3u,a
;aBf	[
t!LBs<
YyRyc}R=
EO4y4q
Z8H+Y&
hfmWle
w9Mtel(
~J6<F/
=rI3K:
zmH/UQ
de97!s
0K-kj-
=RBrZG
{2JK k}
Y4*poj
c M- <
\O;4K@z?e
(`W-RO
\+s>m<
{z@'v5
?\CRzJo
3G))O6~
	u~.~w
GBS<|Ng
KT*6'p u
A_Yjt\'
WRcWn+
8q.ipO
U`,(vF
}"h/zQ
$G.9.H~!
9_,!,<(
X/CY(g*
=fN$r-
W?=sdJi
]L*Qt)
6{UFZ>
sn-*pf
BT089 
TXzyVF
 W4WX}
AIg'}&
&c @K[
moapMb
cct;tr
Te(@*$
SWjvK5W
	zU+3@
5Zf9=}
 :S3]2
KyAfJdC
k|T~qbR
te{4z}
!!fp9U
r8B?-x;q8I
>Ms}Xn97
lv+.i/
,+0g(Ws
V|J&In~e`
F5Lzz["[
xdC\tTsI
Tj*yZf
GE23l'V
Fc4*]K
B%iK4K
l2jgCG>
w&.!C^
>L#JK;q
w|\BT#
vp67uM<
E:awij}
+WRPO	
bls&H:
kg`{UL+
C3jUdFf
cE[h",7
{ijyp)
R+12"I=
Rq\$\P
:u^XBPs;
JJ|GIh~eG
`76>OE
)_%Fo~
XAIf$^
~)}7P.
z1"+*p"
\GbTZGi
oX)fcE
;*RO~5
sYF'lM
H1x,	^
~|]0De}3
ruCQzN
f%RfYd
`A70xE
C	{/;\
f.yd#u
0I$PDlU9_I
zQ^5Wt
6=_2^N
MH8B{ca
UF2R9jx
@+a8\P
i`-q{9UG
r>%8BR[
1(Ld00
8p)1, dR:
}klD%"
AseU%M5
XX<;qo
q%5[n]_Z
|k?.T}
BYU=K.
kx"_.,
lXFvYh
?/jXK$
17O/v7
Q.8vHr
9Fr@j9;)/s
eADBpL
.>=H2g5L
H0-1[|
/zX+3Wc
Qs=Q!<
X`8"y{
%m[cRt
JHoB-U+
 .w-v_{
pZVr0	
H@^hW4km
^a@=?'DN
yQl&BB
%{tgK&~
hC<[BO
CI>r;=
\wW' &
o*|K-p
}DV-	>
H"7$0z
0*;]vnM
.	>;E|
{$f]B3,
uI*1sXI
KNOBx&
40*2?BH&n
*d&l+_
L6b^-rq_
UgQc`f
U~R!~$j
iUm'e,	E8
Z"2U=C
Au|47h
sZ7A[ HV
RfIP2;
}1OQd0i
NX8)Wt
=!4~{;
}4}ssTX9
Vb`\_9J
dCE+f2
7hL}8l
)pVwq%p4
szP1+v
5P?e{j
0%# tw
)3sKFu
*5WD3^l
Ofaa l
}-g4n>v
=wb}/	
qJY,/]6G
]lq8\KH
J	O'mO
[Hij@#k
[JgGxM
nN#79R
$\^g@)6q
R4{/8V
lHg=y'S
rE'eUK
g&zL Z*
0bFo;(
cL(ts\
vE%De"
X\#If?o
D\a0_`
'~1K>O
qT	&'+
[,lv0 
/x{X$}
>@2;|^
-EjZ@m
"XmG-4@j:
1z	4wy
++3Zyz
*^*780
bSc7{vvTg
dNz$%E[mxm
FT~e4Z
#>(/L)
{o2He#9!B
*_l\?Q
yh%W L
3#+<je
2/-22M
Ts8-iw
h8*)Y3
IJsD3B
Tdc9Vme
w(<`)y
!.<1ta.
MxCT~[F
SpF8M'
Myssrp
Hyd!M-
*3)kH 
`Y_(H{
V/5UY8
NO)yN-
7lj	HP	J
+e_F.8
X\|koj
-cYOC07
tV[u`k
meg)A(
)*fB*y
RFt/)q
	P&OF,,~*
[83q=U
W*W|>Gv
yGs&%x
dhn$T3
"	1v39
tnS3~)[NW
	jt c"
XJavJC
:N&&?{
#TCSOGP
E'*,y)
up-q!U)wb
YUswrl
M'I+r{o
D.:*=U
8u|wH6=H
KS,rRa$
hu]XSu.A
JHm	4iuON
q0l`~[
#Ds++C
MW=m~o
L{OG$V
x?~R<k
<ZYj;gD
YUR<N 
 @NDp/
]KYt"rd
.@V1Z|oRI
j'@"%V
CkD9('
]uu&@	t
JTfm7Z
YG~*^ 
i2CSE$
F=)q0.a
 f&9l,
-cp%^bR.
Q$vaNb
YZ:=+,
#$P&2j
y^6@o5
]oLspp
A^!fc#	R
|)D6QU
BYDR?8
;(w|{4
*x/B|'
#6u^t)
M[]4<Z
/_h|'b
2UHR8,
d@O'C)
9dU6,A
5Ao={M
{}9yyIS{
R};<!w=82T@#N
Iu&lp	
/p?\H:@
^!DA4 }
4WN2/C
a<DfPU
o/	nIH
P{HZ>6n
h7*H?%a!
(l]Z[M
yQ^5k%
L.P0Ph
:buC?!
'04Z]h
N.Md)C
@~WfTK
DDMB5)
WeaC?8:
\wH~>@3
aqpR45
7V5"R|
AMEA9*r
6E$gmr
ZPGu N
TV:b7C
aKm6B{
Bz'Wyr~*
oLvqa@v`
[#uWLS
dC8`mH:
`r~D%?'
sicDO:
"a$l>s
-TQ!aR
By8I=~
tRd@{@+t
cXf'wb%
,f(uQ*
>m9m{Z
<z;Iv->P
I?rSf'
1m3(Tx
5CvX+UE&3
ne=Gb`R
U(]*C4
jC,\Kd
kIkJDQ0
auHY88
I;#4wt
,| t73
G7WZj~
cbI$y)
'5%0^(h{2
89J*t5*m
Z(Zu0f7
!enZwX
9>aaqj
(GlD8\
FSMJDL
*98kt_
uHvz>v
rI/M;+e
Xw6P|(u-UL
vj~aMp
=2D}19q
Cyo.S2p=
g%G{@(
BD@;ELv
L<W+	 %b
.:k8GM
?]m.WMc
vd0ch1
xz8'{v|o
y"dtS\6|P
Rp0N3i@H
y9Ac:U
7'H+&q
4\=~p(
A]WCc>
<V|?Gco
sJQCRVC
)/6s7CA
PWK*A"-
ZP51Ft
)}{y-{=g
8-U!^(
rWXyMN/
>1xigA
^> FpL	
DDAnDs
\vPRWT
 /dV"G
kf;,S'p%
R rqL7r[ELN
;'E^.h
>x]8A'
'cdK9y>
"5YB.V
&n1e3~-
p!N~yW
MnI*fNlc
)cnq2Z
4M$O]hB	(\
.{(1;#O
vuVTksbU
.!C	nE
chh`AH
Z)^!g?
}:zgf@9:
joHKXC
L_]o9F
B}!B36
c MH}-
5*sR-f
U@CIl2
 J5l<8
XZ	!auv
uE5 F+
>Ze[bk
~<KV9"a
"?}[!J
'?i3?/
8<pp+S
13)Vh 
kHa	ga
pk2E%!
cG!Q@<
4RT@A- 
`o!Rkx
SQjM58R}
bD0tsm
B<egr@V4
WFEbNt
'},=Wu*v
T;@<a2
Hafa#,f
YRBGFM
^g4j)g^a
3by4/vl
x@4$v{J^
Q~o0+*
#i`9k>
K	-]4B
L]s,f^
d?j&x9
xqHF1%ku
RWe~7f
kIP8%q
ckk8?1
|wwx1i
}Fz_|R
P)FH_k
DkC[Zf
2'FU1\$]
jlZuN*
X~+t$*?
5i}TS	
lbbM29
At,wJ?
6BXFa1L
mp8h|Y
Wky':V
wz&/i4U
XwvU/D=H
.Ho_[~q
r	!qY'
vi)Z+$"
K%N.z4
B!n[5{
0BP?ov
 M>&,U
Ygtx!D
Adv4d(z 
>2tpno
^Tx>6g
^"@7`!
UUK5(o
$;:_	24N	H
2.Lp_D
Id\))A
=[j__1b.
BAIh0r4
KeaB TO
KiyLUj
\"I""!
tU|w:-kV
}uwb.>w
l~ aXNgW
U#pb^{
}4mpVj18
d. MU^
Gs.Y'L
fMFd;|
Cy_,1zc^|
rJ9%(b$
X^2]k`
%*	*aYkU
Db^lHiK/
I4R*6aj
<Y'<'@[
PcHq76
qAQ'JE
\Q-0xG
X!8CL 
%B2U4_
fd,[km
TN	~5S
$Y]4bG
nwyN,O
c^2D-f
1S]e!Y6c
tC#ZmY
hc~jWl
3w]K3x
>9_2Z"i
#y&zXo
,9[j4Ech
B,T.#K
?8x[Aw
D.h6f!fVf^
SHELL32.DLL 
AShell_NotifyIconW
^<fWf_
fWf_SfWf_S
fVf^fWf_
NAfVf^
fVf^fWf_fI
PfVf^Z
fVf^;}<u
0Hq):CGSg
|):9G_
 B{rB	Gq_
&+dyx4a
HTgJP*
ebz,u]
'`t0]PR
ia2+	w
C,c!vg
p3@zao
 Xl(UIJ
/#{7!X
lT\hD#9=
	T\YD#l=
Ti$REG
P-q"ig
)av1_RT
X}20%~9"
)bv2_RT
]:~/vu
_\t&oW
Unfranked
MSVBVM60.DLL
_CIcos
_adj_fptan
__vbaFreeVar
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
_adj_fprem1
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaObjSet
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
_adj_fdiv_m32i
_adj_fdivr_m32i
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarDup
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
IIIII33333333+MG
qIII33833M8
_"?OSJ'
};IIWd
*nnu@I5K
#\rz,`%
j$[cbC
33~s!/jR	
M333~GL4
033333
33333333EPTT5